Addressed Lawrence's comments on RAB PR.

Author: vverman

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java

@@ -62,9 +62,9 @@
  * infrastructure to enforce regional security restrictions. This class does not perform any
  * client-side validation or enforcement.
  */
-public final class RegionalAccessBoundary implements Serializable {
+final class RegionalAccessBoundary implements Serializable {
 
-  public static final String X_ALLOWED_LOCATIONS_HEADER_KEY = "x-allowed-locations";
+  static final String X_ALLOWED_LOCATIONS_HEADER_KEY = "x-allowed-locations";
   private static final long serialVersionUID = -2428522338274020302L;
 
   // Note: this is for internal testing use use only.

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

@@ -172,10 +172,10 @@ void triggerAsyncRefresh(
       } catch (Exception | Error e) {
         // If scheduling fails (e.g., RejectedExecutionException, OutOfMemoryError for threads),
         // the task's finally block will never execute. We must release the lock here.
-        refreshFuture.set(null);
-        future.setException(e);
         handleRefreshFailure(
             new Exception("Regional Access Boundary background refresh failed to schedule", e));
+        future.setException(e);
+        refreshFuture.set(null);
       }
     }
   }
@@ -203,7 +203,7 @@ private void handleRefreshFailure(Exception e) {
     if (cooldownState.compareAndSet(currentCooldownState, next)) {
       LoggingUtils.log(
           LOGGER_PROVIDER,
-          Level.INFO,
+          Level.FINE,
           null,
           "Regional Access Boundary lookup failed; entering cooldown for "
               + (next.durationMillis / 60000)